WordPress Gallery Blocks with Lightbox plugin <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className Parameters vulnerability

🗓️ 28 Jun 2024 06:39:09Reported by WebbernautType

Authenticated stored XSS exists in WordPress gallery blocks via galleryID and className in SimpLy Gallery up to 3.2.1.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2024-5424	28 Jun 202409:15	–	attackerkb
CNNVD	WordPress plugin Gallery Blocks with Lightbox security vulnerability	28 Jun 202400:00	–	cnnvd
CVE	CVE-2024-5424	28 Jun 202408:33	–	cve
Cvelist	CVE-2024-5424 Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className Parameters	28 Jun 202408:33	–	cvelist
EUVD	EUVD-2024-46646	8 Apr 202618:33	–	euvd
NVD	CVE-2024-5424	28 Jun 202409:15	–	nvd
Patchstack	WordPress Gallery Blocks with Lightbox Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)	28 Jun 202400:00	–	patchstack
RedhatCVE	CVE-2024-5424	23 May 202509:29	–	redhatcve
Vulnrichment	CVE-2024-5424 Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className Parameters	28 Jun 202408:33	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (June 24, 2024 to June 30, 2024)	3 Jul 202415:31	–	wordfence

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/simply-gallery-block/gallery-blocks-with-lightbox-image-gallery-html5-video-youtube-vimeo-video-gallery-and-lightbox-for-native-gallery-321-authenticated-contributor-stored-cross-sit

28 Jun 2024 06:39Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.4

EPSS0.00213

SSVC